quasar | 36ea2fb6f0b7279ea15e54dba6d2c41a00bc3f56e26a59e1bf21867865b2e2db

Analysis

max time kernel
145s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
27-12-2024 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rev's External.exe
Size

3.1MB
MD5

abdb9928a2443e939fd0e3b2758fac86
SHA1

963518e3d31b32ade1faa2d3ad4a5f29f4a94718
SHA256

36ea2fb6f0b7279ea15e54dba6d2c41a00bc3f56e26a59e1bf21867865b2e2db
SHA512

3b21a68634fe6c467de89614a7719aed29d664d83857dc3f9684eaa96a155e349aa471bf2bd7a526e201de4805ce2072224de0bb6763490fce6da61b089eb2bb
SSDEEP

49152:Xvluf2NUaNmwzPWlvdaKM7ZxTwi0zBBxLSoGd5THHB72eh2NT:Xvwf2NUaNmwzPWlvdaB7ZxTwJz8

Score

10^/10

quasar aurareal discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

AuraReal

tcp://auraboyy-27610.portmap.host:23133 => 4782:23133

Mutex

23455755-5d9f-40df-b240-406c00706fe9

Attributes

encryption_key
2482B7514A53EC61E5CFC0A64CF01CDEB49C6056
install_name
Win64.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
Extras

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 9 IoCs

resource	yara_rule
behavioral1/memory/2392-1-0x0000000000AD0000-0x0000000000DF4000-memory.dmp	family_quasar
behavioral1/files/0x000900000001628b-6.dat	family_quasar
behavioral1/memory/2992-8-0x0000000000C10000-0x0000000000F34000-memory.dmp	family_quasar
behavioral1/memory/1464-23-0x0000000000C90000-0x0000000000FB4000-memory.dmp	family_quasar
behavioral1/memory/2192-44-0x0000000000220000-0x0000000000544000-memory.dmp	family_quasar
behavioral1/memory/2552-56-0x00000000009A0000-0x0000000000CC4000-memory.dmp	family_quasar
behavioral1/memory/692-67-0x00000000012A0000-0x00000000015C4000-memory.dmp	family_quasar
behavioral1/memory/1136-78-0x00000000013A0000-0x00000000016C4000-memory.dmp	family_quasar
behavioral1/memory/2188-152-0x00000000013B0000-0x00000000016D4000-memory.dmp	family_quasar

Executes dropped EXE 15 IoCs

pid	Process
2992	Win64.exe
1464	Win64.exe
1660	Win64.exe
2192	Win64.exe
2552	Win64.exe
692	Win64.exe
1136	Win64.exe
3060	Win64.exe
2528	Win64.exe
1868	Win64.exe
1008	Win64.exe
3032	Win64.exe
1708	Win64.exe
2188	Win64.exe
1540	Win64.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Rev's External.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File created	C:\Windows\system32\Extras\Win64.exe	Rev's External.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Rev's External.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1968	PING.EXE
2912	PING.EXE
3004	PING.EXE
1604	PING.EXE
3068	PING.EXE
620	PING.EXE
1940	PING.EXE
1308	PING.EXE
1960	PING.EXE
2100	PING.EXE
920	PING.EXE
2436	PING.EXE
2996	PING.EXE
2996	PING.EXE
3040	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
2100	PING.EXE
620	PING.EXE
920	PING.EXE
1604	PING.EXE
2996	PING.EXE
3068	PING.EXE
3040	PING.EXE
2996	PING.EXE
1308	PING.EXE
1960	PING.EXE
2436	PING.EXE
1968	PING.EXE
1940	PING.EXE
2912	PING.EXE
3004	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1644	schtasks.exe
2720	schtasks.exe
1088	schtasks.exe
1612	schtasks.exe
1892	schtasks.exe
284	schtasks.exe
372	schtasks.exe
2372	schtasks.exe
2836	schtasks.exe
2236	schtasks.exe
1656	schtasks.exe
2716	schtasks.exe
3048	schtasks.exe
1216	schtasks.exe
2480	schtasks.exe
1564	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2392	Rev's External.exe
Token: SeDebugPrivilege	2992	Win64.exe
Token: SeDebugPrivilege	1464	Win64.exe
Token: SeDebugPrivilege	1660	Win64.exe
Token: SeDebugPrivilege	2192	Win64.exe
Token: SeDebugPrivilege	2552	Win64.exe
Token: SeDebugPrivilege	692	Win64.exe
Token: SeDebugPrivilege	1136	Win64.exe
Token: SeDebugPrivilege	3060	Win64.exe
Token: SeDebugPrivilege	2528	Win64.exe
Token: SeDebugPrivilege	1868	Win64.exe
Token: SeDebugPrivilege	1008	Win64.exe
Token: SeDebugPrivilege	3032	Win64.exe
Token: SeDebugPrivilege	1708	Win64.exe
Token: SeDebugPrivilege	2188	Win64.exe
Token: SeDebugPrivilege	1540	Win64.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2992	Win64.exe
1464	Win64.exe
1660	Win64.exe
2192	Win64.exe
2552	Win64.exe
692	Win64.exe
1136	Win64.exe
3060	Win64.exe
2528	Win64.exe
1868	Win64.exe
1008	Win64.exe
3032	Win64.exe
1708	Win64.exe
2188	Win64.exe
1540	Win64.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
2992	Win64.exe
1464	Win64.exe
1660	Win64.exe
2192	Win64.exe
2552	Win64.exe
692	Win64.exe
1136	Win64.exe
3060	Win64.exe
2528	Win64.exe
1868	Win64.exe
1008	Win64.exe
3032	Win64.exe
1708	Win64.exe
2188	Win64.exe
1540	Win64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 372	2392	Rev's External.exe	31
PID 2392 wrote to memory of 372	2392	Rev's External.exe	31
PID 2392 wrote to memory of 372	2392	Rev's External.exe	31
PID 2392 wrote to memory of 2992	2392	Rev's External.exe	33
PID 2392 wrote to memory of 2992	2392	Rev's External.exe	33
PID 2392 wrote to memory of 2992	2392	Rev's External.exe	33
PID 2992 wrote to memory of 2372	2992	Win64.exe	34
PID 2992 wrote to memory of 2372	2992	Win64.exe	34
PID 2992 wrote to memory of 2372	2992	Win64.exe	34
PID 2992 wrote to memory of 2280	2992	Win64.exe	36
PID 2992 wrote to memory of 2280	2992	Win64.exe	36
PID 2992 wrote to memory of 2280	2992	Win64.exe	36
PID 2280 wrote to memory of 2220	2280	cmd.exe	38
PID 2280 wrote to memory of 2220	2280	cmd.exe	38
PID 2280 wrote to memory of 2220	2280	cmd.exe	38
PID 2280 wrote to memory of 2996	2280	cmd.exe	39
PID 2280 wrote to memory of 2996	2280	cmd.exe	39
PID 2280 wrote to memory of 2996	2280	cmd.exe	39
PID 2280 wrote to memory of 1464	2280	cmd.exe	40
PID 2280 wrote to memory of 1464	2280	cmd.exe	40
PID 2280 wrote to memory of 1464	2280	cmd.exe	40
PID 1464 wrote to memory of 2716	1464	Win64.exe	41
PID 1464 wrote to memory of 2716	1464	Win64.exe	41
PID 1464 wrote to memory of 2716	1464	Win64.exe	41
PID 1464 wrote to memory of 2292	1464	Win64.exe	43
PID 1464 wrote to memory of 2292	1464	Win64.exe	43
PID 1464 wrote to memory of 2292	1464	Win64.exe	43
PID 2292 wrote to memory of 376	2292	cmd.exe	45
PID 2292 wrote to memory of 376	2292	cmd.exe	45
PID 2292 wrote to memory of 376	2292	cmd.exe	45
PID 2292 wrote to memory of 920	2292	cmd.exe	46
PID 2292 wrote to memory of 920	2292	cmd.exe	46
PID 2292 wrote to memory of 920	2292	cmd.exe	46
PID 2292 wrote to memory of 1660	2292	cmd.exe	49
PID 2292 wrote to memory of 1660	2292	cmd.exe	49
PID 2292 wrote to memory of 1660	2292	cmd.exe	49
PID 1660 wrote to memory of 1644	1660	Win64.exe	50
PID 1660 wrote to memory of 1644	1660	Win64.exe	50
PID 1660 wrote to memory of 1644	1660	Win64.exe	50
PID 1660 wrote to memory of 2016	1660	Win64.exe	52
PID 1660 wrote to memory of 2016	1660	Win64.exe	52
PID 1660 wrote to memory of 2016	1660	Win64.exe	52
PID 2016 wrote to memory of 1284	2016	cmd.exe	54
PID 2016 wrote to memory of 1284	2016	cmd.exe	54
PID 2016 wrote to memory of 1284	2016	cmd.exe	54
PID 2016 wrote to memory of 3004	2016	cmd.exe	55
PID 2016 wrote to memory of 3004	2016	cmd.exe	55
PID 2016 wrote to memory of 3004	2016	cmd.exe	55
PID 2016 wrote to memory of 2192	2016	cmd.exe	56
PID 2016 wrote to memory of 2192	2016	cmd.exe	56
PID 2016 wrote to memory of 2192	2016	cmd.exe	56
PID 2192 wrote to memory of 3048	2192	Win64.exe	57
PID 2192 wrote to memory of 3048	2192	Win64.exe	57
PID 2192 wrote to memory of 3048	2192	Win64.exe	57
PID 2192 wrote to memory of 2808	2192	Win64.exe	59
PID 2192 wrote to memory of 2808	2192	Win64.exe	59
PID 2192 wrote to memory of 2808	2192	Win64.exe	59
PID 2808 wrote to memory of 644	2808	cmd.exe	61
PID 2808 wrote to memory of 644	2808	cmd.exe	61
PID 2808 wrote to memory of 644	2808	cmd.exe	61
PID 2808 wrote to memory of 1308	2808	cmd.exe	62
PID 2808 wrote to memory of 1308	2808	cmd.exe	62
PID 2808 wrote to memory of 1308	2808	cmd.exe	62
PID 2808 wrote to memory of 2552	2808	cmd.exe	63

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Rev's External.exe
"C:\Users\Admin\AppData\Local\Temp\Rev's External.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:372
- C:\Windows\system32\Extras\Win64.exe
  "C:\Windows\system32\Extras\Win64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2372
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\M9N17zZKUBJG.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2220
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2996
  - - C:\Windows\system32\Extras\Win64.exe
      "C:\Windows\system32\Extras\Win64.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1464
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2716
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\sf23Ceuoetcl.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2292
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:376
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:920
      - C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1644
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\bdqjoApjYi3W.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1284
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3004
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3048
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\7a4vA7pIc754.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2808
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:644
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1308
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2552
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2480
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\0KWgDLdQXy7I.bat" "
        11⤵
        
        PID:1728
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1720
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1604
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:692
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1088
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\TesYS3iRCiqQ.bat" "
        13⤵
        
        PID:2496
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:904
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1960
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1136
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1612
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\H1R9aTW8gmTh.bat" "
        15⤵
        
        PID:3000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:1656
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2100
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3060
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2836
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\MUo02fJKtoYK.bat" "
        17⤵
        
        PID:2484
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2876
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2996
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2528
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2720
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\BxOi4gaYuCx9.bat" "
        19⤵
        
        PID:2140
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2612
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3068
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1868
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1564
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\P439wCCPjgWy.bat" "
        21⤵
        
        PID:1664
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2948
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3040
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1008
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1216
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\T2cS8gmXJF56.bat" "
        23⤵
        
        PID:3048
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2476
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2436
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3032
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1892
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\mTWQ3hJfCLVl.bat" "
        25⤵
        
        PID:1264
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2304
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1968
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1708
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:284
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\4dq0cINec2S9.bat" "
        27⤵
        
        PID:2200
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:2488
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:620
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2188
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2236
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\19En2ysttKwv.bat" "
        29⤵
        
        PID:2468
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2672
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1940
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1540
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1656
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Z0KgffZRgpnB.bat" "
        31⤵
        
        PID:296
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2400
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2912

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0KWgDLdQXy7I.bat

Filesize
195B

MD5
d881fcf62129a03a03f47ed6dd2a1356

SHA1
4b924c4d520406fd08275e3d4a5ee78f31567704

SHA256
7fabc5a638cde578f83223e661203a43871014551a4b3fd7227bc7492005730d

SHA512
c152fe8e4c869bf1eba91bf118111c469f1cf23dfe7e90b2a969b2f245c1922ef630a4d74a563725499370bcc1b70e59b7328004b5d05721b1d34ced0b6bc26b

Download Submit
C:\Users\Admin\AppData\Local\Temp\19En2ysttKwv.bat

Filesize
195B

MD5
f355942dd42ea6c76f37f9ce266f18a4

SHA1
f8da0fbc61e7b80ef2527d7e02cb1eeb520ea664

SHA256
58dae94d74a52ab7d37f2be76f7c3a939d645719a58fe43da68abe76878746a9

SHA512
1495da62df29d20a53dfaa978261f5d5146234cd5c07c7a019118b080e4665f00b2308771d0df0f8fbca9a25a80a67f4474abef41db2572e533f08682b8440c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\4dq0cINec2S9.bat

Filesize
195B

MD5
d250e6afb4c499aea36053e14229dc87

SHA1
d524b3d479490247faf392f81c78613c63f3847a

SHA256
e6197a93cbf96d9b41ac9dc6d8e16010f12868237f6f5acd7adc6f288a2ec8b8

SHA512
340d770fe91363f2b7adafd633df0dae81c6bf66f7ccf16c93bfd16a515b22743fa8b8ee68ff443d9eb977c734cbdae62343cace121ab1f6398ef11c89947df8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7a4vA7pIc754.bat

Filesize
195B

MD5
657fc76b3fbfc8de310cad88ab442b74

SHA1
e7a5ba233281d5727fd957dd187d0c84f26e7e4d

SHA256
084543b1bd2fd1b2bc9366adc3cfb0d96565db25e98f44e0c71186ebd8f1fc9d

SHA512
dcb2e7a039c2afddbc737394997a096a3b32d9ede3b0dcbcb6d19f4203b953b1ce258a0123e0147b03f8b589f08cd013d24c2a5f105e7de22d0dd45ff5f0b78d

Download Submit
C:\Users\Admin\AppData\Local\Temp\BxOi4gaYuCx9.bat

Filesize
195B

MD5
64d3e75389527b445707851f92775902

SHA1
08aec44baa10316b7334e69cbbdc7a26dc7a160a

SHA256
e8e02710f04e032752957a284c9fdfd3b52c6b880d899c6f4ec7cb8bc577c47f

SHA512
2b58a1998fef6c030cfd93a6bbb53f6656c222415cf1ee16cf63d745c6c43ef90031c959e6af267d62bca259fca277ec5d1e2d05656cf50e040cd87e418c77b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\H1R9aTW8gmTh.bat

Filesize
195B

MD5
5e975559e61bb5c60bc2f786f8ba2f1b

SHA1
18711740e124f10e1991384493a02643b3a813c2

SHA256
4a18414436b15a7b880a3272da57d8f69e144915b1d8d5f31c5175f2db767f58

SHA512
98e5ac904fc3edb95ddebfa72d984a2a1d84bcd0b68c09e6ed04e0b2a6e82e1fb262c92e86902fda016b689e448f78d1effd073f51e71860fed5ece0500cf4e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\M9N17zZKUBJG.bat

Filesize
195B

MD5
62e8f76fe46c566bbae1fa0fa45d74a3

SHA1
3558fd00af3fa5d215b3af8bdb22a7ca6a6fab3f

SHA256
cf04785a58ca9855d86d6c36f14183cd2af202b9e3d71816861afb981e4b7b70

SHA512
60aa8e63695d0aacb0c51ab5d38ae92707bd085e964a07c352b59ed7a160b0b0b3fd6242d496438017c9e4ae1c958b8f2d6756ac4809fbceaffc8fd59d088e8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MUo02fJKtoYK.bat

Filesize
195B

MD5
6bd9a3b81960187c8189e5b2232aba07

SHA1
72285174ef58e762ea62a3374fdf9cf95f2cd6cf

SHA256
f46b34eeaec2e4397b59ef16df69d9759459bd339b279b306291f9639575dd82

SHA512
8c69eabd660e5c7fa1092700ab12ecc830491e857708ca83a42c8d3d4bfcbeacb4623414d83a00db3cf027b86ecce6e008736e35d273dae3bfe50e83a14af456

Download Submit
C:\Users\Admin\AppData\Local\Temp\P439wCCPjgWy.bat

Filesize
195B

MD5
6162b16c1ce465836c72024856ff219b

SHA1
1c78afb69c182521eba5e58cac8bff8202ab2a2f

SHA256
29971c8afe2dd44d9af8a032d62347167d5a276ac3b2d6d404a8b5f400293b9e

SHA512
9e119c9abcd73b95ecb1917182641f6aa1ae88169a556ca860e9db2118d4a95831255c43d332e136b353118d4f5a541f99643a83419850f0c2aa5e7eec69a81a

Download Submit
C:\Users\Admin\AppData\Local\Temp\T2cS8gmXJF56.bat

Filesize
195B

MD5
fbec28655fe32eb0b0f51ca193e291b3

SHA1
1f0fc6739fbce63baf74152eebb4658b121afd7f

SHA256
85711278b76fc328e3c18582b7c38de12903f3c173fc46a351bcf3cbe84259ac

SHA512
73219869a5edb893281eec9a63468ae58a3703a669fd93fa62422d2dc1e34f5f902e592aefb3a103b8ca2b4fbcf0c92d58fa3548b29f477ef5788f5520b0309b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TesYS3iRCiqQ.bat

Filesize
195B

MD5
611c116fc79f494c596799befff9e632

SHA1
9ff3c867ee614bcb94c789790840f5267ad14ff3

SHA256
7b36a05af2aa462a93840324ec41b42f0efd13e05e1186f30cc7aa24d8ddac38

SHA512
8a1040f8d077ab5e075b206529e52dbb8f34d2213e9584815e001419f76500cf87e84635df99b14a995a068e32963c50f2528d9fdb510ee9442dc254686ce75f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z0KgffZRgpnB.bat

Filesize
195B

MD5
4ad91a0cccead2edb99a5963ccf88b1a

SHA1
00d1b44999ef7a19bf4fa1410102be1bed780776

SHA256
e1c6bbd80b4a816d45a0b5d61e02f111c9907ddb7c4749ae791461cce69008a1

SHA512
03b4bae81e3d15fdd4d74600c6fa96a17cffb2f0097815f67e513b94de93214f498f80bbc6094b45a4a99dbada284a432e90d0a1b863397197e46f7d859a8efb

Download Submit
C:\Users\Admin\AppData\Local\Temp\bdqjoApjYi3W.bat

Filesize
195B

MD5
ca562cd96003f27d7efa63e0232cbcce

SHA1
498e05045109d147fbae1759466c5ab2e9f21dbf

SHA256
c59b8e7bfdaa61c939b00a21a3a0eb9a7b3c0a18c3a30303c65c7289cbe5e7b2

SHA512
4ff87d9c0a5ab1d229719fb4ed3a5584e593c165964188b162124e8c1c3ce9ccd2db974f8937d1fc88ee18aaae7a66f312150b1a00bfc7b0bfbbf274fe275507

Download Submit
C:\Users\Admin\AppData\Local\Temp\mTWQ3hJfCLVl.bat

Filesize
195B

MD5
048b5cf70c642bd1150266537c9944a6

SHA1
a1f6c76070e9e77d13d116d4b426a7f66c724ef7

SHA256
adbd699f9211b3af6399ee2e815f87cdc1f6781d27bdf1648635513d91e9d27c

SHA512
2afd3b9c3512cc934dcd06e24c67c914eccf25bc9acbbfca90d7d715e5ee4a2d70605218b2672d087c2aa377cf94dd341e235945fd2a2c2c0b507f2a6372a4ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\sf23Ceuoetcl.bat

Filesize
195B

MD5
fbf7615c42e16934e9a6006ae9544a6e

SHA1
bedf01001aad78e3dd8c5a3d2aafa43ec7e35b62

SHA256
6addce597e470270e2121f5b5d46684924e04a69624da4b91d4c2852e3471756

SHA512
158165a2ceb30dba4369abf20cfb6484e4c44f52a7c3d345ab258e1bf0465488c75a7f1977e8eaee2647590768319591b5e101b585e6b90252d88bed59e8baae

Download Submit
C:\Windows\System32\Extras\Win64.exe

Filesize
3.1MB

MD5
abdb9928a2443e939fd0e3b2758fac86

SHA1
963518e3d31b32ade1faa2d3ad4a5f29f4a94718

SHA256
36ea2fb6f0b7279ea15e54dba6d2c41a00bc3f56e26a59e1bf21867865b2e2db

SHA512
3b21a68634fe6c467de89614a7719aed29d664d83857dc3f9684eaa96a155e349aa471bf2bd7a526e201de4805ce2072224de0bb6763490fce6da61b089eb2bb

Download Submit
memory/692-67-0x00000000012A0000-0x00000000015C4000-memory.dmp

Filesize
3.1MB

Download
memory/1136-78-0x00000000013A0000-0x00000000016C4000-memory.dmp

Filesize
3.1MB

Download
memory/1464-23-0x0000000000C90000-0x0000000000FB4000-memory.dmp

Filesize
3.1MB

Download
memory/2188-152-0x00000000013B0000-0x00000000016D4000-memory.dmp

Filesize
3.1MB

Download
memory/2192-44-0x0000000000220000-0x0000000000544000-memory.dmp

Filesize
3.1MB

Download
memory/2392-9-0x000007FEF60B0000-0x000007FEF6A9C000-memory.dmp

Filesize
9.9MB

Download
memory/2392-0-0x000007FEF60B3000-0x000007FEF60B4000-memory.dmp

Filesize
4KB

Download
memory/2392-2-0x000007FEF60B0000-0x000007FEF6A9C000-memory.dmp

Filesize
9.9MB

Download
memory/2392-1-0x0000000000AD0000-0x0000000000DF4000-memory.dmp

Filesize
3.1MB

Download
memory/2552-56-0x00000000009A0000-0x0000000000CC4000-memory.dmp

Filesize
3.1MB

Download
memory/2992-21-0x000007FEF60B0000-0x000007FEF6A9C000-memory.dmp

Filesize
9.9MB

Download
memory/2992-11-0x000007FEF60B0000-0x000007FEF6A9C000-memory.dmp

Filesize
9.9MB

Download
memory/2992-10-0x000007FEF60B0000-0x000007FEF6A9C000-memory.dmp

Filesize
9.9MB

Download
memory/2992-8-0x0000000000C10000-0x0000000000F34000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads